Skip to content

backward slicing error in arm64 binary #1408

@riusksk

Description

@riusksk
from __future__ import print_function
from triton     import *

import sys


function = {
    0x3ADFC8: b"\xFE\x07\xC1\xDA",      # PACIB           X30, SP
    0x3ADFCC: b"\xFF\x43\x01\xD1",      # SUB             SP, SP, #0x50
    0x3ADFD0: b"\xFD\x7B\x02\xA9",      # STP             X29, X30, [SP,#0x40+var_20]
    0x3ADFD4: b"\xF5\x1B\x00\xF9",      # STR             X21, [SP,#0x40+var_10]
    0x3ADFD8: b"\xF4\x4F\x04\xA9",      # STP             X20, X19, [SP,#0x40+var_s0]
    0x3ADFDC: b"\xFD\x83\x00\x91",      # ADD             X29, SP, #0x20
    0x3ADFE0: b"\xFF\x7F\x01\xA9",      # STP             XZR, XZR, [SP,#0x40+holder.section]
    0x3ADFE4: b"\xFF\x07\x00\xF9",      # STR             XZR, [SP,#0x40+holder]
    0x3ADFE8: b"\x00\x01\x00\xB5",      # CBNZ            X0, loc_3AE008
    0x3ADFEC: b"\xF4\x03\x1F\x2A",      # MOV             W20, WZR
    0x3ADFF0: b"\xE0\x03\x14\x2A",      # MOV             W0, W20
    0x3ADFF4: b"\xF5\x1B\x40\xF9",      # LDR             X21, [SP,#0x40+var_10]
    0x3ADFF8: b"\xF4\x4F\x44\xA9",      # LDP             X20, X19, [SP,#0x40+var_s0]
    0x3ADFFC: b"\xFD\x7B\x42\xA9",      # LDP             X29, X30, [SP,#0x40+var_20]
    0x3AE000: b"\xFF\x43\x01\x91",      # ADD             SP, SP, #0x50 
    0x3AE004: b"\xFF\x0F\x5F\xD6",      # RETAB
    0x3AE008: b"\x08\x00\x40\xF9",      # LDR             X8, [X0]
    0x3AE00C: b"\x08\x1D\x40\xB9",      # LDR             W8, [X8,#0x1C] 
}



if __name__ == '__main__':
    # Triton context
    ctx = TritonContext()

    # Set the architecture
    ctx.setArchitecture(ARCH.AARCH64)

    # Symbolic optimization
    ctx.setMode(MODE.ALIGNED_MEMORY, True)

    # Define the Python syntax
    ctx.setAstRepresentationMode(AST_REPRESENTATION.PYTHON)

    # Define entry point
    pc = 0x3ADFC8


    # Let's emulate the function
    for pc in function:
        # Build an instruction
        inst = Instruction()

        # Setup opcode
        inst.setOpcode(function[pc])

        # Setup Address
        inst.setAddress(pc)

        # Process the instruction
        ctx.processing(inst)
        #print(inst)

        # Spread the instruction address and its disassembly into its symbolic
        # expressions. Used to refer an instruction to its expressions. Will
        # be useful to understand the slicing part.
        for se in inst.getSymbolicExpressions():
            se.setComment(str(inst))

        reg_obj = ctx.getRegister('X8')

        # Let's slice (backward) the rcx expression at 0x4005ae
        if pc == 0x3AE00C:
            x8Expr = ctx.getSymbolicRegister(reg_obj)
            slicing = ctx.sliceExpressions(x8Expr)
            # Sort the slicing and display all expressions with their comments
            for k, v in sorted(slicing.items()):
                # Here we display the comment to understand the correspondence
                # between an expression and its referenced instruction.
                print('[slicing]', v.getComment())
            break

    sys.exit(0)

After execution, the following result is output:

[slicing] 0x3ae00c: ldr w8, [x8, #0x1c]

The correct result should be:

[slicing] 0x3ae008: ldr x8, [x0]
[slicing] 0x3ae00c: ldr w8, [x8, #0x1c]

Question: Is the issue with my code, or does Triton have bugs in analyzing ARM64 programs?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions